june/fi-nix-infra
1
0
Fork 0
forked from fi/nix-infra
Code Pull requests Activity

Migrate matrix to sops-nix

Browse source
This commit is contained in:
fi 2026-05-18 21:21:20 +02:00
commit a01a891495
Signed by: fi
SSH key fingerprint: SHA256:dgX1HRsK+8F1OzYvKfv1VLhMJac/Iv/rsjixuV94+dA
5 changed files with 85 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

11
config/hosts/matrix/element-call.nix
View file

@ -4,15 +4,22 @@
enable = true;
settings.rtc.use_external_ip = true;
openFirewall = true;
keyFile = "/secrets/matrix-livekit-secret-key.secret";
keyFile = "/run/secrets/matrix-livekit-secret-key";
};
services.lk-jwt-service = {
enable = true;
port = 8082;
livekitUrl = "wss://matrix-rtc.nekover.se/livekit/sfu";
keyFile = "/secrets/matrix-livekit-secret-key.secret";
keyFile = "/run/secrets/matrix-livekit-secret-key";
};
systemd.services.lk-jwt-service.environment = {
LIVEKIT_FULL_ACCESS_HOMESERVERS = "nekover.se";
};
sops.secrets."matrix-livekit-secret-key" = {
mode = "0440";
owner = "root";
group = "root";
restartUnits = [ "livekit.service" "lk-jwt-service.service" ];
};
}

9
config/hosts/matrix/matrix-authentication-service.nix
View file

@ -92,7 +92,7 @@ in
serviceConfig = {
Type = "simple";
ExecStart = "${pkgs.matrix-authentication-service}/bin/mas-cli server --config=${masSettingsFile} --config=/secrets/matrix-mas-secret-config.secret";
ExecStart = "${pkgs.matrix-authentication-service}/bin/mas-cli server --config=${masSettingsFile} --config=/run/secrets/matrix-mas-secret-config";
WorkingDirectory = "${pkgs.matrix-authentication-service}";
User = "matrix-synapse";
Group = "matrix-synapse";
@ -102,4 +102,11 @@ in
"multi-user.target"
];
};
sops.secrets."matrix-mas-secret-config" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-authentication-service.service" ];
};
}

41
config/hosts/matrix/matrix-synapse.nix
View file

@ -51,7 +51,7 @@
notif_from = "Nekoverse Matrix Server <nyareply@nekover.se>";
};
max_upload_size = "500M";
signing_key_path = "/secrets/matrix-homeserver-signing-key.secret";
signing_key_path = "/run/secrets/matrix-homeserver-signing-key";
admin_contact = "mailto:admin@nekover.se";
web_client_location = "https://element.nekover.se";
enable_metrics = true;
@ -86,10 +86,41 @@
};
extras = [ "oidc" ];
extraConfigFiles = [
"/secrets/matrix-registration-shared-secret.secret"
"/secrets/matrix-turn-shared-secret.secret"
"/secrets/matrix-email-smtp-pass.secret"
"/secrets/matrix-homeserver-mas-config.secret"
"/run/secrets/matrix-registration-shared-secret"
"/run/secrets/matrix-turn-shared-secret"
"/run/secrets/matrix-email-smtp-pass"
"/run/secrets/matrix-homeserver-mas-config"
];
};
sops.secrets."matrix-homeserver-signing-key" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-synapse.service" ];
};
sops.secrets."matrix-registration-shared-secret" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-synapse.service" ];
};
sops.secrets."matrix-turn-shared-secret" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-synapse.service" ];
};
sops.secrets."matrix-email-smtp-pass" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-synapse.service" ];
};
sops.secrets."matrix-homeserver-mas-config" = {
mode = "0440";
owner = "matrix-synapse";
group = "matrix-synapse";
restartUnits = [ "matrix-synapse.service" ];
};
}

61
config/hosts/matrix/secrets.nix
View file

@ -1,61 +0,0 @@
{ keyCommandEnv, ... }:
{
deployment.keys = {
"matrix-registration-shared-secret.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/registration-shared-secret" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
"matrix-turn-shared-secret.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/turn-shared-secret" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
"matrix-email-smtp-pass.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/email-smtp-pass" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
"matrix-homeserver-signing-key.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/homeserver-signing-key" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
"matrix-homeserver-mas-config.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/homeserver-mas-config" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
"matrix-mas-secret-config.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/mas-secret-config" ];
destDir = "/secrets";
user = "matrix-synapse";
group = "matrix-synapse";
permissions = "0640";
uploadAt = "pre-activation";
};
"matrix-livekit-secret-key.secret" = {
keyCommand = keyCommandEnv ++ [ "pass" "matrix/livekit-secret-key" ];
destDir = "/secrets";
user = "root";
group = "root";
permissions = "0640";
uploadAt = "pre-activation";
};
};
}

31
config/hosts/matrix/secrets.yaml Normal file
View file

File diff suppressed because one or more lines are too long